CVE-2026-15978 CVE-2026-15978

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...

EUVD-2026-51266

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...

CVE-2026-15978

The SGLang framework, an open-source tool for serving large language models, contains a model weight exfiltration vulnerability (CVE-2026-15978 ). When no API keys are configured, the framework exposes two endpoints that allow a remote attacker to trigger distributed weight broadcasting via NCCL ...

CVE-2026-15978: Missing Authentication for Critical Function

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...

PT-2026-66563

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description When no API keys are configured, the software exposes two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL NVIDIA Collective Communications Library,...

SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure

Overview Six vulnerabilities have been discovered within the SGLang project, including remote code execution RCE, server-side request forgery SSRF, local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, an...